In some MAJOR banks (not gonna say which one), the last digits of the IBAN are also used as username.

So basically people outside can lock your online account.

I am shocked by how F** dumb this was ever designed.